Open source · Contextual scoring

Prioritize vulnerabilities by real risk, not just CVSS.

Your scanner found 300 CVEs. Vens takes your Trivy or Grype report plus a short description of your system, and scores every CVE by its real risk to you. You get a CycloneDX VEX with OWASP Risk Rating scores, so you fix what matters.

Get started View on GitHub

Install go install github.com/venslabs/vens/cmd/vens@latest

Same scan, re-scored for your system

By CVSS

300

By vens

~30

Critical / High Low, in your context

How it works

From a raw scan to scores you can act on.

1
Scan

Run Trivy or Grype and export the JSON report. Vens is not a scanner, it ranks what your scanner finds.
2
Describe your system

A short config.yaml: exposure, data sensitivity, compliance, controls.
3
Score

vens generate sends your CVEs, with your context, to an LLM and computes an OWASP risk score for each one.
4
Act

Get a CycloneDX VEX with OWASP ratings. Fold them back into your report with vens enrich, push them to a vulnerability management platform like Dependency-Track, or fail CI on real criticals.

Context changes the answer

The same CVE moves in both directions.

CVSS 8.8 HIGH → OWASP 10.0 LOW

RCE in a library whose vulnerable path never runs in your build. Not reachable, not urgent.

CVSS 5.3 MED → OWASP 52.0 HIGH

Info leak in a handler that processes PII under GDPR. Higher risk for your system, not lower.

300 CVEs → ~30 urgent

Context filters the backlog down to what actually applies to you. Stop patching by severity alone.

Scenarios are illustrative. Actual scores depend on your config.yaml and the model you run. See CVSS vs OWASP contextual.

What you get

Contextual scoring, in a format your pipeline already speaks.

Context-aware OWASP scoring

Risk = Likelihood × Impact (0 to 81), driven by your exposure, data, and controls. Not generic CVSS.

Works with Trivy and Grype

Auto-detected from the JSON report. Bring your own scanner, vens ranks the output.

Machine-readable VEX

Standard CycloneDX VEX. Suppress noise in CI, or feed it to Dependency-Track.

Model-agnostic

OpenAI, Anthropic, Google AI, or fully local with Ollama. Swap providers with a flag.

Auditable by design

--attest writes a CycloneDX attestation: model, hashes, and reasoning, so every score can be reproduced.

Backed by a benchmark

We measured 12 LLMs on this exact job. Pick a model on evidence.

Two commands in

Score your first report.

# 1. describe your system
cat config.yaml
project:
  name: my-api
context:
  exposure: internet
  data_sensitivity: high
  business_criticality: high
  compliance_requirements: [GDPR]

# 2. score your scanner report
export OPENAI_API_KEY=sk-...
vens generate --config-file config.yaml \
  --sbom-serial-number "urn:uuid:$(uuidgen | tr '[:upper:]' '[:lower:]')" \
  report.json output.vex.json

Full quickstart, 5 minutes

Is vens for you?

Security engineers drowning in CVE backlogs from Trivy, Grype, or Dependency-Track.
DevSecOps teams who need machine-readable VEX to suppress noise in CI.
Security architects who want risk that reflects business impact, not generic CVSS.

Documentation

Jump straight in.

Quickstart, 5 minYour first VEX from a real image. GitHub ActionsDrop vens into your Trivy or Grype pipeline. Describe your contextThe config.yaml that makes scores accurate. Prioritize a CVE backlogThe most common use case. Enrich your reportFold OWASP scores back into Trivy. config.yaml schemaEvery field, explained.

Stop patching by CVSS.

Score the CVEs that actually matter for your system.